Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T17C03EFB1D0D2983B06A3D2E1F3213E1DB1C1922DD65B9864CFF55B6BE787CA0ED04269 |
|
CONTENT
ssdeep
|
384:8nAULHX2QKXOy470V75Qe7ycEb70/AucJmOXpX4H2lNWehOpmDp/n:8njLHmTm9B704LjNWIOpmDpf |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
b84643493eb0eccf |
|
VISUAL
aHash
|
0000ffc7cfcbcfc7 |
|
VISUAL
dHash
|
72f03e3e36129b1f |
|
VISUAL
wHash
|
0000ffc7cbcbcbc3 |
|
VISUAL
colorHash
|
0b0010001c0 |
|
VISUAL
cropResistant
|
1e3e1f16369b1b1f,ce727272f2f0e8f4,efff9edd5c3c36ab,2327cde7e84a539e |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 34 techniques to evade detection by security scanners and make reverse engineering more difficult.